Introduction: Stop Applying from Laptops

The Problem with "Works on My Machine" Infrastructure

Imagine a bank where any teller can open the vault, move money, and close it again — with no camera, no log, and no second signature required. That is essentially what happens when engineers run terraform apply from their laptops. The change happens, the cloud changes, and nobody else knows exactly what was done, when, or from which version of the code.

This is the default state for many teams that adopt Terraform. The code lives in Git, but the execution is informal, manual, and invisible.

The Four Failure Modes of Manual Apply

1. Visibility gap: There is no audit trail of when apply was run, by whom, or against which exact version of the code. The Git commit history shows what changed in the file, but not whether that change was ever applied — or when.

2. Drift from source of truth: An engineer pulls main, makes a local tweak to debug something, and runs apply. The cloud now reflects code that was never reviewed and never merged. The repository no longer describes reality.

3. Credential sprawl: Every engineer who might need to apply changes needs direct, high-privilege credentials to the production cloud account. This dramatically expands the blast radius of a compromised laptop or a phishing attack.

4. No enforcement of process: Even if your team has a policy of "always get a review before applying," there is nothing technically preventing someone from skipping it. Policy without enforcement is just a suggestion.

GitOps Defined

GitOps is an operational model where Git is not just a version history — it is the single source of truth and the operational control plane. Every change to infrastructure must flow through a Git pull request, and an automated system is the only entity permitted to execute that change against real infrastructure.

The four principles of GitOps, applied to infrastructure:

1. Declarative: The desired state of the system is expressed as code (Terraform HCL, YAML, etc.).
2. Versioned and immutable: All desired state is stored in Git. History is preserved. Rollback is a git revert.
3. Pulled automatically: An automated agent detects changes in Git and reconciles the real world to match.
4. Continuously reconciled: The agent does not just apply once — it continuously checks whether reality matches the declared state and corrects drift.

The crucial rule that makes GitOps work: no human ever runs terraform apply manually against a shared environment. The moment you allow exceptions, the model breaks down. The cloud state diverges from Git, and you lose the guarantee that Git describes reality.